Using AI Tools Under GDPR: A Practical Guide for EU Teams

I am not a lawyer and this is not legal advice - but I have sat on both sides of this, helping teams set up AI tooling in the EU, and the same four questions decide whether a tool is allowed on the work laptop: what data goes in, where does it get processed, who else can see it, and how long is it kept. If a vendor cannot answer those four plainly, the tool is not ready for customer data, no matter how good the model is.

The practical starting point is that most personal data should not go into a consumer chat tool at all. A name, an email and a contract clause are personal data under GDPR, and pasting them into a general assistant usually means they land on infrastructure outside your control, get used for improvement under terms you did not negotiate, and are harder to delete than you expect. The default that works for most teams is: consumer tools for internal, non-sensitive work, enterprise agreements for anything touching customers.

The setting that does more work than any policy document is turning off training on your data. It exists in most enterprise tiers and often in consumer settings as well, and it is the difference between your prompts being training data and not. Where a business account does not say clearly whether prompts are used for training, treat that as a no until you get it in writing.

Data residency matters more in Europe than the marketing pages suggest. If your team insists on EU-hosted processing, verify the region rather than trusting a flag icon, and check the subprocessors list for the vendors you actually use - model providers, transcription services, and any automation tool that sits in the middle. Each one is a separate transfer question, and they multiply.

Retention is where most teams are surprised. Chat histories that live in a workspace for years are a liability that outlives the project, and the delete request that arrives in eighteen months will be harder if the data was never designed to expire. Ask your vendor about retention windows and deletion guarantees before you need them, and set your own internal rule about what should never be pasted in the first place.

What finally convinced me to write policy instead of advice was watching a small team invent its own rules - no customer data in consumer tools, no source code from private repositories, no health information, and a five-minute approval step before anything goes to a model outside the approved list. Simple enough to remember, specific enough to enforce, and it survived the first audit.

Frequently asked questions:

Q: Is using ChatGPT at work illegal under GDPR?

A: Not automatically, but using a consumer account for customer data is very hard to defend, because you usually cannot show where the data was processed, whether it was used for training, or that it was deleted on request. For internal, non-personal work it is generally fine.

Q: What is the minimum I should do before rolling out an AI tool to a team?

A: Four things: a business plan with training on your data switched off, an approved-tools list, an internal no-paste list covering customer data and source code, and a named owner who answers questions when someone gets stuck.

Q: Do I need a data processing agreement with the vendor?

A: Yes, and it is usually available on business tiers. If a vendor will not sign one, that is a clear signal not to send them personal data, regardless of how good the product is.